Overview

overview

10

Static

static

10

fd9cbccbd2...93.exe

windows7-x64

10

fd9cbccbd2...93.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd9cbccbd2803786c5ea2bf54b22d693.exe

  • Size

    1.0MB

  • MD5

    fd9cbccbd2803786c5ea2bf54b22d693

  • SHA1

    97b675207f5679503f89096e7ae99b38b1bea382

  • SHA256

    0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7

  • SHA512

    900fb67bf952111fbfd9eb494afa3fb119cc0d6db782a4b2be9cb9228ba6ee1723bb1ccd5835ac7e5b248e005cde7f84a1c59cf01d7bf2f81e3cc819e69293c1

  • SSDEEP

    24576:1LY5kMJDyGouUqg75HVDBvdJ9x5LESqRel+kvujSZGp:x4kMJDyGouUqg75HVDBvdzESqRelDvuc

Score
10/10
1877quasar

Malware Config

Extracted

Family

quasar

Version

2.7.0.0

Botnet

1877

C2

overthinker1877.duckdns.org:4545

Mutex

xiBqon3YI4gHicsPTt

Attributes
  • encryption_key

    IshCdNN3oYnjATmMydkq

  • install_name

    1877.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • fd9cbccbd2803786c5ea2bf54b22d693.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections